GreyNoise Reports 597,000-Session Spike in SonicWall SonicOS API Scanning, Echoing Pattern Before CVE-2026-0400
Between May 9 and May 18, 2026, GreyNoise observed a major spike in scanning of SonicWall SonicOS management interfaces. The May 12 peak of about 597,000 sessions was the largest single-day total on the SonicWall SonicOS API Scanner tag in 90 days, roughly 46x the typical daily volume. Earlier spikes on this tag (January 18, January 30 and February 14) came 37, 25 and 10 days before the February 24 disclosure of CVE-2026-0400, so the current activity may be an early warning of a new SonicWall disclosure. GreyNoise stresses this is one observed precedent, not an established rule, and that it is publishing the signal rather than predicting a CVE.
Technical Details
- Roughly 99% of requests use a single browser user-agent, Chrome 119 on Linux x86_64, the same fingerprint seen in 94.5% of the Q1 SonicWall scanning, so the tooling appears unchanged.
- About 56% of sessions come from networks announced in the Netherlands and 44% from Ukraine, over 99% of volume combined.
- A single ASN, AS211736, carries about half of the session volume. The IPs involved are overwhelmingly classified by GreyNoise as Suspicious.
- Ports 80 and 8080 (HTTP) carry virtually all of the scanning.
Remediation
- Restrict SonicOS management API and SSL VPN portal access to known administrative ranges and eliminate public exposure of management interfaces.
- Require MFA on all SSL VPN accounts.
- Audit SonicOS configuration for new administrative accounts created since May 1, 2026.
- Apply a dynamic IP blocklist at the network edge.
- Over the coming weeks, monitor the SonicWall PSIRT advisory feed and plan to patch within 24 hours of any disclosure.
- Increase log retention and outbound-traffic alerting on SonicWall appliances.
Linha do tempo
-
GreyNoise Reports 597,000-Session Spike in SonicWall SonicOS API Scanning, Echoing Pattern Before CVE-2026-0400
ler a análise desta fonte ocultar
Between May 9 and May 18, 2026, GreyNoise observed a major spike in scanning of SonicWall SonicOS management interfaces. The May 12 peak of about 597,000 sessions was the largest single-day total on the SonicWall SonicOS API Scanner tag in 90 days, roughly 46x the typical daily volume. Earlier spikes on this tag (January 18, January 30 and February 14) came 37, 25 and 10 days before the February 24 disclosure of CVE-2026-0400, so the current activity may be an early warning of a new SonicWall disclosure. GreyNoise stresses this is one observed precedent, not an established rule, and that it is publishing the signal rather than predicting a CVE.
Technical Details
- Roughly 99% of requests use a single browser user-agent, Chrome 119 on Linux x86_64, the same fingerprint seen in 94.5% of the Q1 SonicWall scanning, so the tooling appears unchanged.
- About 56% of sessions come from networks announced in the Netherlands and 44% from Ukraine, over 99% of volume combined.
- A single ASN, AS211736, carries about half of the session volume. The IPs involved are overwhelmingly classified by GreyNoise as Suspicious.
- Ports 80 and 8080 (HTTP) carry virtually all of the scanning.
Remediation
- Restrict SonicOS management API and SSL VPN portal access to known administrative ranges and eliminate public exposure of management interfaces.
- Require MFA on all SSL VPN accounts.
- Audit SonicOS configuration for new administrative accounts created since May 1, 2026.
- Apply a dynamic IP blocklist at the network edge.
- Over the coming weeks, monitor the SonicWall PSIRT advisory feed and plan to patch within 24 hours of any disclosure.
- Increase log retention and outbound-traffic alerting on SonicWall appliances.